I wrote an article for Increment Magazine on password practices, and where ideas about what people should do diverge from real-world actions. You can read it here.